Abstract
A commercial closed circuit television digital video recorder was investigated to determine if it was possible to extract useful video data from its storage media without access to the manufacturer's application software. After an initial test period the storage disk was removed, imaged and analysed. The file structure of the storage disk was deduced and the features necessary to locate a sequence of video evidence identified.
The format of video data from the device was considered and shown to be based upon standard compression technologies. The observed format was fully documented to enable further development. With a little extra effort in processing the raw video data it was shown how video sequences could be extracted for use as evidence even in cases where the recording device is no longer functional, the turnkey software not available, or data partly corrupted. With careful application standard media players can be employed to view the resulting video sequences.
Conclusions are that, while based on proprietary file systems and video formats, data from digital video recorder systems is amenable to analysis using commonly available computer tools. In return for investigative work there is a reasonable probability of being able to recover usable video from systems. There is also scope for the development of more specialised software tools to facilitate this process.
The format of video data from the device was considered and shown to be based upon standard compression technologies. The observed format was fully documented to enable further development. With a little extra effort in processing the raw video data it was shown how video sequences could be extracted for use as evidence even in cases where the recording device is no longer functional, the turnkey software not available, or data partly corrupted. With careful application standard media players can be employed to view the resulting video sequences.
Conclusions are that, while based on proprietary file systems and video formats, data from digital video recorder systems is amenable to analysis using commonly available computer tools. In return for investigative work there is a reasonable probability of being able to recover usable video from systems. There is also scope for the development of more specialised software tools to facilitate this process.
| Original language | English |
|---|---|
| Pages (from-to) | 85-92 |
| Journal | Digital Investigation |
| Volume | 5 |
| Issue number | 3-4 |
| DOIs | |
| Publication status | Published - Mar 2009 |
Bibliographical note
The full text of this item is not available from the repository.Keywords
- digital forensics
- CCTV
- DVR
- file systems
- video formats